IRDA Draft Guidelines on Outsourcing

Transcription

1 IRDA Draft Guidelines on Outsourcing 2 February 2011 See attached a copy of the Outsourcing Guidelines released by the IRDA. Please note that these guidelines come into effect immediately and all present arrangements which are not in consonance with these guidelines must be modified by 30th June For further information on this topic please contact Tuli & Co Tel , fax or [email protected]

2 IRDA/Life/CIR/GLD/013/02/ st February, 2011 Guidelines on Outsourcing of Activities by Insurance Companies Reference: 1. INV/CIR/031/ dated 27 th July, INV/CIR/058/ dated 28 th December, RBI/2006/167 DBOD.NO.BO.40/ / Regulation 7(c) of IRDA (Registration of Companies) Regulations, INTRODUCTION 1.1 Insurers in India are increasingly using outsourcing, as a means of both reducing cost and accessing expertise, not available internally and achieving strategic aims. 'Outsourcing' may be defined as Insurer s use of a third party (either an affiliated entity within a corporate group or an entity that is external to the corporate group) to perform activities on a continuing basis that would normally be undertaken by the Insurer itself, now or in the future. These outsourcing arrangements are becoming increasingly complex. 1.2 Joint Forum set up by Basel Committee on Banking Supervision, International Organization of Securities Commissions and International Association of Insurance Supervisors has devised high-level principles on outsourcing in financial firms which gives guidance to firms, and to regulators, in effectively managing risks involved in outsourcing without hindering the efficiency and effectiveness of firms. Reserve Bank of India also brought out Guidelines on Managing Risk and Code of Conduct in outsourcing of financial services vide reference 3 cited above. This circular is issued based on best practices adopted internationally as outlined in above document. These instructions are intended to provide direction and guidance to insurers to adopt sound and responsible risk management practices for effective oversight. 1.3 Regulation 7 (c) of IRDA (Registration of Companies) Regulations, 2000, clearly sates The applicant will carry on all functions in respect of insurance business including management of Investment within its own organization. It has been observed that certain insurers are outsourcing even core activities such as Investment, Underwriting and Policy servicing. It is not desirable to outsource the core and important activities which will affect corporate governance, protection of policy holders, solvency and revenue flows of insurer. 1.4 In order to ensure proper corporate and regulatory oversight over the outsourcing of activities of insurers, the Authority has decided to issue following instructions under Section 14(2) of Insurance Regulatory and Development Authority Act, These guidelines apply in addition to the instructions given vide reference 2 cited above. 1

3 1.5 However this circular supercedes the provisions of para 3 of reference 2 cited above. 1.6 The insurer shall ensure that outsourcing arrangements neither diminish its ability to fulfill its obligations to Policyholders nor impede effective supervision by IRDA. Insurers therefore have to take steps to ensure that the service provider employs the same standards in performing the services as would be employed by them if the activities were conducted in house. Accordingly, insurers should not engage in outsourcing that would result in their internal control, business conduct or reputation being compromised or weakened. 1.7 Activities of insurers are broadly classified into two categories namely Core and Non-Core, in accordance with Regulation 7(c) of IRDA (Registration of companies) Regulation, CORE ACTIVITIES 2.1 All activities relating to:- i. Underwriting, ii. Product design and all Actuarial functions and Enterprise wide Risk Management iii. Investment and related functions iv. Fund Accounting including NAV calculations v. Admitting or Repudiation of all Claims vi. Bank Reconciliation vii. Policyholder Grievances Redressal viii. Approving Advertisements ix. Market Conduct issues x. Appointment of Surveyors and Loss Assessors xi. Compliance with AML, KYC etc. xii. All integral components of the above activities shall be treated as Core Activities 2.2 Policy Servicing and related activities 2.3 Insurers shall not outsource any of the core activities listed in para NON CORE ACTIVITIES: i. Facility management i.e. Housekeeping, Security, Catering, etc. ii. PF Trust iii. Internal audit, Internal / branch /concurrent audit etc. (Note: However, the Board of Directors shall appoint the internal /branch / concurrent auditor based on the recommendation of the Audit Committee / Investment Committee respectively as mandated by the Authority in Corporate Governance Guidelines. The report of internal auditor / concurrent auditor shall be placed before the Audit Committee / Investment Committee / Board Meeting for their information and necessary action) 2

4 iv. Website Development and Management / Software and other IT Support v. Pay Roll Management vi. HR Services vii. Service Tax Consultancy and Support viii. TDS filing ix. Compliance with labour laws x. Data entry Including Scanning, Indexing Services xi. Printing and posting of reminders and other documents xii. Pre employment medical checkups xiii. Reminders for Premium Payment xiv. Call Centre and outbound calling for registering complaints or answering enquiries xv. Claim Processing for Overseas Medical Insurance Contracts xvi. Tele-marketing xvii. Consultancy Services pertaining to Service Tax, Income Tax and any other taxes payable by insurer xviii. xix. Other Employee Benefits Deployment of personnel within the premises / offices of the Insurer on a contract basis 4. ACTIVITIES SUPPORTING CORE ACTIVITIES: 4.1 Certain activities which support the core activities as listed in column 3 of Annexure I may be outsourced as per risk management principles outlined in these guidelines subject to reporting requirements. 4.2 Activities in column 4 of Annexure I, which insurers normally assign to outside professionals, regulated either under different laws or provide outside expertise and economies, may be outsourced to such entity as otherwise legally permitted to carry out those activities. 5. PREMIUM COLLECTION & CHEQUE PICK-UP ACTIVITIES: 5.1 The insurer shall ensure that the entities, other than those referred at Sl No. 3 Column No. 4 of Annexure 1 shall be only a Company registered under Indian Companies Act, Such entities engaged for cheque pick-up shall have a net worth of at least Rs.10 Crores. However, these conditions are not applicable to Scheduled Commercial Banks and Post Office. 5.2 In respect of outsourcing of premium collection, insurers shall strictly ensure that the same is outsourced only to entities listed at Sl.No.2 of Column Notwithstanding what is stated at Sl No. 2 of Column 4 of Annexure 1 Insurers are also permitted to outsource cheque pick up and premium collection to their 3

5 respective Individual Agents and Corporate Agents in respect of those policies that are not sourced by such intermediaries. Such collection and pick up by agents who have not procured such business is regarded as outsourcing. However, Insurers shall carry out the due diligence on individual agents and corporate agents while outsourcing the same. However, the activity of premium collection / cheque pick up referred in this paragraph shall be subject to the following conditions. 5.4 The total amount entrusted to be collected and picked up by Agents and Corporate Agents for a given financial year shall not exceed three times the renewal commission that the said agent earned in the preceding financial year. Thus it is a prerequisite for carrying out activity that such agents are in existence at least for a period of 2 years. 5.5 The insurer shall assign this activity to agents and corporate agents by allocating only a specified list of the policies, where the services of the agents that procured the business are no longer available to the insurer. 5.6 The above referred conditions are not applicable in respect of Scheduled Commercial Banks, Post Office when these activities are carried out in their capacity as a collecting bank. 5.7 Where an insurer permits its agent to collect premiums on its behalf, it shall be noted that in such instances the agent is acting on behalf of insurers. Insurer shall remain accountable to the receipts issued by the authorised agents / intermediaries. 5.8 Insurers shall notify Policyholders about all the options available for payment of premiums. 6. Bank Reconciliation: With reference to 2.1 (vi) the Insurer is solely responsible for reconciling various Bank Accounts, cash and other instruments; and accountable to any liabilities created through these accounts. However, Insurers are allowed to outsource clerical activities like sorting and organizing the instruments to Scheduled Commercial Banks. The activity of tallying that what is stated in the account and actual availability of instrument shall not be outsourced. The Scheduled Commercial Banks shall be required to submit the certified copies of compilation of various assets inclusive of Cash / Fixed Deposits etc. 7.Policy Servicing and Related Activities: With regard to the activities referred in para 2.2, the following components of the activities, referred at point no. 7.1, are allowed to be outsourced to any service provider at the discretion of the Insurers and as per these guidelines. However, it is reiterated that execution of these services shall remain to be Core Activity to be carried out by the Insurers: 4

6 7.1 Receiving requests in physical/electronic/telephonic forms and transmitting to the insurer without accessing the original data base of Insurers for the following areas of Policy Servicing; i. Issuance of Policy Document / Certificates of Insurance ii. Change of Name / Address iii. Fund Switching/ Premium Redirection iv. Surrender, Maturity, Withdrawals Free look Cancellations Payouts v. Loan Against Policy vi. Change of Policy Terms and Conditions / Details Change vii. Registration of Assignment / Nomination viii. Revival / Cancellation of Policy ix. Transfer of Policy x. Substitution of Vehicle Communications, Reports, Printouts to Policyholders / Claimants xi. Laid up Vehicles xii. Withdrawal of No Claim Bonus xiii. Declarations Update xiv. Extension of Cover xv. Duplicate Policy xvi. Document Collection and Investigation for complying with AML and KYC norms 8. General Principles: Outsourcing of activities allowed in these guidelines are subject to following general principles. 8.1 To avoid a potential conflict of interest no insurer shall outsource the internal audit to their respective statutory auditors The third party service providers engaged by insurers are subject to the various provisions of Insurance Act, 1938, IRDA Act, 1999, Rules, Regulations or any other orders issued there under. The third party service provider shall comply with provisions of Regulations, Guidelines and any other law under force and the insurer shall be responsible for all acts of omission and commission of its third party service providers in this regard The regulated activities of the Agents, Corporate Agents, Brokers, TPA s, Surveyors and other regulated entities, as provided in the Insurance Act,1938, IRDA Act,1999 and Regulations, guidelines made there under, are not covered by these guidelines Subject to these Guidelines, Agents, Corporate Agents, Brokers, TPA s and Surveyors and other regulated entities shall not be contracted to perform any outsourced activity other than those permitted by the respective regulations/instructions governing their licensing and functioning. 5

7 9. Risk Management Principles: While outsourcing activities every insurer shall abide by criteria laid down in the following principles: 9.1 An insurer intending to outsource any of its activities shall put in place a comprehensive outsourcing policy, approved by its Board, which incorporates, inter alia, criteria for selection of such activities as well as service providers, delegation of authority depending on risks and materiality and systems to monitor and review the operations of these activities. 9.2 In case any of the third party service provider becomes a group entity as defined vide IRDA (Investment) Regulations, 2000, the insurer shall report the fact to the Authority within 30 days of such an event. 9.3 The Board of Directors of insurer shall review the performance of all third party service providers every year with respect to compliance with provisions of Insurance Act 1938, Regulations, Rules or any other order issued there under. 9.4 In case of termination of contract between insurer and third party service provider, the compensation or penalty or any payment in lieu of foreclosure shall be reasonable and shall not be excessive. 9.5 Insurer shall establish a comprehensive outsourcing risk management programme to address the outsourced activities and the relationship with the service provider. 9.6 Some factors that could help in considering materiality in a risk management programme include the following: i. The financial, reputational and operational impact on the insurance company of the failure of a service provider to adequately perform the activity ii. iii. iv. Cost Benefit Analysis; Potential losses to policyholders and their counterparts in the event of a service provider failure; Consequences of outsourcing the activity on the ability and capacity of the insurer to conform with regulatory requirements and changes in requirements, v. Interrelationship of the outsourced activity with other activities within the Insurance Company. vi. vii. Affiliation or other relationship between the insurer and the service provider; Regulatory status of the service provider; 6

8 viii. ix. Degree of difficulty and time required to select an alternative service provider or to bring the business activity in-house, if necessary; and Complexity of the outsourcing arrangement. For example, the ability to control the risks where more than one service provider collaborates to deliver an end-to-end outsourcing solution. 9.7 Data protection, security and other risks may be adversely affected by the geographical location of an outsourcing service provider. To this end, specific risk management expertise in assessing country risk related, for example, to political or legal conditions, could be required when entering into and managing outsourcing arrangements that are taken outside of the home country. 9.8 Insurer shall ensure that outsourcing arrangements neither diminish its ability to fulfill its obligations to policyholders and regulators, nor impede effective supervision by regulators. 9.9 Outsourcing relationships shall be governed by written contracts that clearly describe all material aspects of the outsourcing arrangement, including the rights, responsibilities, expectations of all parties. The outsourcing contracts may carry the following components:- i. The contract shall clearly define what activities are going to be outsourced, including appropriate service and performance levels. The service provider s ability to meet performance requirements in both quantitative and qualitative terms should be assessable in advance; ii. iii. iv. The contract shall neither prevent nor impede Insurer from meeting its respective regulatory obligations, nor the regulator from exercising its regulatory powers of conducting inspection, investigation, obtaining information from either the insurer or the third party service provider. Insurer must ensure it has the right to access all books, records and information relevant to the outsourced activity in the third party service provider; The contract shall provide for the continuous monitoring and assessment by Insurer of the service provider so that any necessary corrective measures can be taken immediately; v. A termination clause and minimum periods to execute a termination provision, if deemed necessary, shall be included. The latter should allow the outsourced services to be transferred to 7

9 vi. another third-party service provider or to the Insurance Company. Such a clause shall include provisions relating to insolvency or other material changes in the corporate form, and clear delineation of ownership of intellectual property following termination, including transfers of information back to the Insurer and other duties that continue to have an effect after the termination of the contract; Material issues unique to the outsourcing arrangement shall be meaningfully addressed. For example, where the third party service provider is located abroad, the contract shall include choice-of-law provisions and agreement covenants and jurisdictional covenants that provide for adjudication of disputes between the parties under the laws of a specific jurisdiction; 9.10 Insurer and its third party service providers shall establish and maintain contingency plans, including a plan for disaster recovery and periodic testing of backup facilities The Insurer shall take appropriate steps to require that third party service providers protect confidential information of both the Insurer and its clients from intentional or inadvertent disclosure to unauthorized persons The Insurer shall ensure that the third party service provider does not have any conflict of interest. The third party service provider or any of their group entities shall not be able to derive any benefit by causing loss to the insurer or policyholder. For instance the third party service provider shall not have the responsibility of repairing the damaged vehicle, supply of spare parts and marketing of the policy. In case of existence of conflict of interest among group entities, the insurer shall avoid outsourcing to such entities No employee of Insurer shall be directly or indirectly involved in (i) creation of or (ii) any outsourced activity of the outsourced entity The Insurer shall ensure that there is no risk of loss of control over outsourced activity and potential impersonal treatment of policy holder / agents, before outsourcing any activity Where the third party service provider is either a group entity as defined in provisions of Regulation (2) (ca) of IRDA (Investment) Regulations, 2000 and having a common director with the insurer, the insurer shall ensure that the transfer pricing is done according to the sound principles and or all such transactions shall be disclosed to the Authority as soon as the agreement is completed and before payment is made to the third party service provider. However nothing contained herein shall be applicable for outsourcing of activities to a scheduled commercial bank 10. Evaluating the Capability of the Service Provider: In considering or renewing an outsourcing arrangement, appropriate due diligence should be performed to assess the capability of the service provider to comply with obligations in the outsourcing agreement. Due diligence should take into consideration qualitative and quantitative, financial, operational and reputational factors. Insurers 8

10 should consider whether the service providers' systems are compatible with their own and also whether their standards of performance including in the area of policyholder service are acceptable to it. Where possible, the insurer should obtain independent reviews and market feedback on the service provider to supplement its own findings Due diligence should involve an evaluation of all available information about the service provider, including but not limited to:- i. Past experience and competence to implement and support the proposed activity over the contracted period; ii. iii. iv. Financial soundness and ability to service commitments even under adverse conditions; Business reputation and culture, compliance, complaints and outstanding or potential litigation; Security and internal control, audit coverage, reporting and monitoring environment, Business continuity management; v. External factors like political, economic, social and legal environment of the jurisdiction in which the service provider operates and other events that may impact service performance. vi. 11. Reporting Requirements: Ensuring due diligence by service provider of its employees The activities outsourced vide point no.4.1 of these guidelines shall be reported to IRDA within 45 days from the date of entering into outsourcing agreement With respect to each of the other outsourced activities all insurers shall file a report in Form A (attached as Annexure-II) within 45 days from the end of every half year. 12. Electronic Issuance of Policies and Data Storage: Where insurers issue policies in electronic form in accordance to the guidelines issued in this regard or where Insurers prefer to outsource the Data Storage, the outsourcing of data storage in electronic form shall be mandatorily with the repository service providers authorised by IRDA. The guidelines for issuance of electronic policies and authorization of repositories will be issued separately In respect of policies issued in electronic form, the terms and conditions of the policies shall be drafted in simple and plain language. Insurers shall take prior approval of IRDA for the text format of such policy documents Insurers are also permitted to allow the execution of the activities referred at point no. 7.1 to the authorised repository service providers at their discretion with respect to all category of policies, both electronic policies and otherwise. 9

11 13. Classification of any of the activities, that are not explicitly referred herein, as core or noncore shall be done after due diligence. Mere listing of an activity as a non core shall not be taken as freedom to outsource without proper risk assessment/due diligence. Further, Insurers are advised to refer to IRDA for further clarification in case of any ambiguity regarding the classification of the activities as core or noncore which are not specified in these guidelines. 14. Redressal of Grievances related to Outsourced services: Every Insurer shall direct in house Grievance Redressal Machinery to deal with grievances relating to services provided by the outsourced agencies. Wide publicity has to be given through print and electronic media about this. The Grievance Redressal Machinery shall deal with every grievance in a fair, objective and just manner and issue reasoned speaking reply for every grievance rejected. It shall also analyze grievances received to help identification of the problem areas in which modifications of policies and procedures could be undertaken with a view to making the delivery of services easier and more expeditious. The TAT s for redressal of grievances shall be as notified by the Authority from time to time 15. Centralized list of Outsourced Agents: If a service provider services are terminated by an Insurer on grounds of mischief, fraud and non compliance with terms and conditions of outsourcing agreement, they shall inform the Authority with reasons for such termination. The Authority would be maintaining a caution list of such service providers for the entire insurance industry for sharing among insurers. 16. These guidelines shall not be construed to be authorizing, any activity which otherwise is prohibited by any law under force and/or Regulation and Guidelines of the Authority. 17. These guidelines would be reviewed by IRDA periodically. 18. These guidelines come into force with immediate effect. 19. The insurers shall terminate all existing outsourcing contracts entered into in contravention of these guidelines before 31 st June, Beyond the time period specified herein, the Authority may relax time limit by 3 more months, on a case to case basis, in respect of existing contracts that are in contravention of this circular. (A.Giridhar) Executive Director Annexure I 10

12 Sl. No. (1) Activity (2) Specified activities that can be outsourced with due reporting (3)* 1. Underwriting Data collection of prospect/insured details, Submission of proposals Data Entry 2. Premium Collection Printing of receipt Dispatch Data entry of details Issuance of receipt Activities external to Insurers may be Outsourced (4)** Data analysis Medical examination Risk management service at policyholders / insured premises Reinsurance Collection by RBI approved banks, institutions, business correspondents of banks Government, private partnerships like AP Online, e-mitra, e-seva, MP Online etc. Government offices like Post office Payment aggregators eg VISA, Mastercard, Bill desk, payments through RBI approved gateway RBI Cleared Payment Collectors, e.g ECS Licensed Insurance Intermediaries, which includes agent / micro insurance agent/ corporate agent/broker who are authorized and who himself procured the policies related to the premium being collected. 11

13 3. Cheque pick up and Banking Picking up from policyholder premises Drop box Picking up from acceptance points 4. Data Storage Scanning Indexing 5. Admitting and repudiation of Claims Cash management services of banks Picking up arrangement with couriers, Post office, Drop box Physical storage of documents Legal / expert / professional opinion Investigation Forensic analysis Salvage / sue and labour Average adjustors Recovery agents Third party claims negotiators Claims document aggregator Accident / road assistance International travel and medical assistance services Global repricing * Refer 4.1 of the Circular ** Refer 4.2 of the Circular 12

14 Annexure II Sl. No. (1) Particulars (2) Activity out sourced (detailed description) Name of the Vendor For the Half Year (3) Form A Up to the Half year (4) For the corresponding Half Year of the preceding year (5) Up to the Half Year of the preceding year (6) 3. Total Amount Agreed Amount Paid so far Whether vendor belongs to insurer group %of outsourcing payments to Operating Expense Date : Signature of CEO 13